Risk Source

The organization identifies where AI-related risk can come from, starting from the Annex B list: how complex the operating environment is, missing transparency or explainability, how far the system is automated, machine learning, hardware issues, life cycle is...

IoT-specific factors and inputs must be considered when identifying risk sources; the risk management itself should use standardised approaches: ISO 31000 for generic risk management, ISO/IEC 27005 for information security risk, IEC 62443 for industrial automa...

The report should identify the risk sources considered: the parties and circumstances from which threats to the PII can arise, internal and external, deliberate and accidental.

For high-risk sources the facility must complete the High-Risk Sources Workbook before the audit and map the factual circumstances of its supply chains, underway and planned: the locations and conditions of extraction, trade, handling and export, including on-...

Likelihood criteria depend on: accidental or natural events; how exposed the information or related asset is to the threat; how far the organisation's vulnerability is exploited; technology failure; and human acts or omissions.

Guidance: risk identification finds, recognizes and describes the risks that might help or prevent the organization achieving its objectives, and depends on relevant, appropriate and current information.